fest-gateway 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Clifton Cunningham
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,274 @@
+# Fest
+
+A self-hosted gateway for Claude Code. Teams point their Claude Code at Fest the
+way they'd point at Bedrock, so one place can monitor requests, tokens and cost —
+and route to different models without Claude Code knowing the difference.
+
+**The distinguishing goal: Claude Max / Team subscription support.** Each
+developer authenticates with their *own* subscription. Fest relays their own
+credential and never stores it. Per-user pass-through, never pooling.
+
+> **Status: feature complete for a team trial.** A real Claude Code session on a
+> Max subscription runs through Fest, is attributed to its developer, metered
+> into SQLite, and shown on a dashboard behind a login. Model routing and
+> substitution work and are visible. Phase 0 cleared both gates
+> ([results](docs/PHASE0-RESULTS.md)), and `npm run canary` re-checks them
+> against each new Claude Code release.
+
+```bash
+docker compose run --rm fest admin create you@corp.test    # password shown once
+docker compose up -d
+docker compose run --rm fest token create dev@corp.test laptop   # shown once
+```
+
+Each developer then points Claude Code at the printed URL:
+
+```bash
+env -u ANTHROPIC_API_KEY -u ANTHROPIC_AUTH_TOKEN \
+  ANTHROPIC_BASE_URL=http://fest.corp:8787/t/<token> claude
+```
+
+Or, if the operator has configured Google/GitHub OAuth (see below), a developer
+can skip all of that and self-serve a token from their own machine:
+
+```bash
+npm install -g fest-gateway                 # the command it installs is `fest`
+
+fest login --server http://fest.corp:8787   # opens a browser, stores a token in ~/.fest
+fest claude                                  # runs `claude`, env set up for you
+fest whoami                                  # what's logged in, and whether it's still live
+```
+
+The package is `fest-gateway` — plain `fest` was already taken on npm — but the
+binary it installs is `fest`. Without installing anything, `npx fest-gateway
+login …` does the same job.
+
+From a clone of this repo the CLI runs straight off the TypeScript instead:
+`npm run cli -- login …` (note the `--`), or `node server/bin/fest.ts login …`.
+
+Or without Docker:
+
+```bash
+node server/bin/fest.ts admin create you@corp.test
+node server/bin/fest.ts token create dev@corp.test laptop
+FEST_REQUIRE_IDENTITY=1 node server/bin/fest.ts serve
+```
+
+## Why this is possible
+
+Claude Code's inference client attaches the subscription OAuth bearer with **no
+host check** against `ANTHROPIC_BASE_URL`. Point it at Fest while logged in with
+Max/Team and Fest receives `Authorization: Bearer sk-ant-oat…`. Confirmed both
+by reading the binary and by running it — see
+[docs/PHASE0-RESULTS.md](docs/PHASE0-RESULTS.md).
+
+Token refresh happens client-side against `api.anthropic.com`, outside
+`ANTHROPIC_BASE_URL`. So Fest **forwards and forgets**: it never stores,
+refreshes or holds a subscription credential. That is a genuine security
+advantage over any "store the team's key" design, not just a side effect.
+
+## Two things that will bite you
+
+**1. `ANTHROPIC_API_KEY` and `ANTHROPIC_AUTH_TOKEN` silently kill the
+subscription.** Claude Code demotes off OAuth if *any* Anthropic-issued
+credential is present — including an `apiKeyHelper`. So Fest's identity token
+never goes in those variables; it rides in the URL path prefix or a custom
+header. A design that ignores this silently moves a whole team off their
+subscriptions onto a server-held key, and the failure is invisible.
+
+**2. This is supported-by-absence, not by design.** There is no *documented*
+path for relaying a subscription bearer through a third-party gateway. It works
+because no guard exists. Treat it as a version-pinned dependency, and settle the
+policy question with Anthropic before a team-wide rollout.
+
+The version dependency is enforced rather than remembered: `npm run canary`
+re-runs both load-bearing Phase 0 experiments against the installed release and
+refuses the rollout if either has changed. See [docs/CANARY.md](docs/CANARY.md);
+verdicts are recorded per version in `docs/canary-history.jsonl`.
+
+Worth knowing: Anthropic ships its own self-hostable `claude gateway` (see
+`claude gateway --help`) with central metering, pricing and managed policies. It
+authenticates via OIDC and holds provider credentials itself, so it cannot do
+subscription pass-through — but if that requirement ever softens, it is the
+supported product.
+
+## Design commitments
+
+- **Byte-for-byte pass-through.** Subscription tokens are validated against
+  request shape, so the body is relayed as opaque bytes — never parsed and
+  re-serialised. No model rewriting or prompt shaping on that path.
+- **`cache_control` forwarded verbatim.** Stripping it silently destroys prompt
+  caching and inflates every developer's token bill.
+- **Metadata only.** Token counts, models, latency, status — never prompt or
+  completion content.
+- **No credential is persistable.** Not by policy, by construction: there is no
+  store to put one in. Only fingerprints, enforced by tests.
+
+## Layout
+
+```
+server/bin/fest.ts       CLI: serve | migrate | token | admin | seed |
+                              login | whoami | claude | logout
+server/pipeline/         passthrough (byte-for-byte) — the subscription path
+server/http/             sse parser, tee, header discipline, errors, routing
+server/store/            SQLite schema, write path, identity tokens
+server/usage/            accumulator, lean pricing, nullable cost algebra
+server/secret/           credential classification + redaction
+server/auth/oauth.ts     Google/GitHub provider construction
+server/api/oauth.ts      /api/auth/oauth/* and /api/auth/identity
+cli/                     the developer half of the CLI — no DB access, ever.
+                         login (loopback OAuth flow) | whoami | claude | logout,
+                         and the ~/.fest config they share
+shared/types.ts          the contracts both halves agree on
+shared/demotion-vars.ts  env vars that silently kill subscription auth
+tools/capture-server.ts  Phase 0 diagnostic (throwaway)
+docs/PHASE0.md           the gating experiment runbook
+docs/CLI-AUTH.md         OAuth setup and the fest login/whoami/claude flow
+test/                    node --test
+```
+
+## Accounting rules that are easy to get wrong
+
+- **The four token buckets are disjoint.** `input_tokens` excludes cache reads
+  and cache writes; context size is the sum. Folding cache reads into input is
+  an order-of-magnitude error on a cache-heavy agent workload — and Claude Code
+  is one (a trivial `-p` call here showed ~16k cache reads and ~12k one-hour
+  cache writes).
+- **`null` cost means unavailable, never zero.** A subscription request is real
+  usage with *no org spend*; an unknown model is unpriced, not free. Rollups
+  therefore carry a priced sum plus `unpriced_requests` and
+  `subscription_requests` separately, so a total renders honestly as
+  `$12.3456 (+3 n/a)`.
+- **For a subscription developer, quota is the scarce resource, not dollars.**
+  Anthropic returns 5h/7d utilisation on every response, so that is what the
+  dashboard shows rather than an invented dollar figure.
+
+## What Fest can see, and what it keeps
+
+This is a gateway every prompt a team writes passes through, so it is worth
+being exact about what that means rather than reassuring.
+
+**Fest sees everything, because it has to.** A request body arrives at this
+process in full: prompts, file contents you asked Claude about, tool results,
+the lot. That is unavoidable for anything sitting on the wire, and no wording
+changes it.
+
+**Fest keeps none of it.** Request bodies are relayed as opaque bytes and never
+parsed for storage. What is written down is metadata: who, when, which model,
+how many tokens in each of the four buckets, latency, HTTP status, error type,
+and the session id Claude Code already sends. There is no column anywhere in
+the schema for prompt or completion text — not disabled, absent — so "turn off
+content capture" is not a setting that could be misconfigured.
+
+**No credential is persistable, by construction rather than by policy.** A
+subscription bearer is forwarded and forgotten; there is no table to put one in.
+What is stored of a Fest identity token or a dashboard password is a hash. The
+leak tests grep the entire database, every log line and every API response for
+secret-shaped strings.
+
+**Raw per-request rows age out after 30 days**; the hourly rollups, which are
+aggregate, are kept for 400 so a year of trends does not require a year of
+per-developer detail.
+
+**An admin can see who used what, and when.** That is the point of a team
+gateway, and the developers pointing their editors at it should be told so
+plainly. They cannot see each other: a `member` account sees only its own
+traffic, enforced in the query layer rather than in the UI.
+
+## Deploying it
+
+`docker compose up -d` after creating an owner account. The image has no runtime
+dependencies — Node runs the TypeScript directly — so it is Node plus this
+repository.
+
+The dashboard needs a sign-in: scrypt passwords, an opaque session cookie
+hashed at rest, an origin check on the two endpoints that mutate anything, and
+an audit log of administrative actions. Accounts are granted from the host with
+`fest admin create`; there is no self-registration and no email reset, because a
+gateway should not need mail credentials to run.
+
+Before anyone has run `fest admin create`, Fest serves the dashboard **open on
+loopback and refuses to start on any other interface**. A single-developer trial
+needs no setup, and "bound it to 0.0.0.0 and forgot the password" cannot happen
+quietly.
+
+Put it behind your own TLS proxy and set `FEST_SECURE_COOKIES=1` when you do:
+the server only ever sees plain HTTP and cannot detect this for itself.
+
+| | |
+| --- | --- |
+| `FEST_PORT`, `FEST_HOST` | listen address. Default `127.0.0.1:8787`. |
+| `FEST_DB`, `FEST_USAGE_LOG` | SQLite path, and the greppable JSONL trail. |
+| `FEST_REQUIRE_IDENTITY` | refuse unattributed requests. Off by default; **on** for a team. |
+| `FEST_SECURE_COOKIES` | set behind HTTPS. |
+| `FEST_ROUTES` | routing table path. Absent means everything passes through. |
+| `FEST_UPSTREAM_BASE_URL`, `FEST_LOG_LEVEL` | |
+| `FEST_PRICING_REFRESH` | set `0` to never fetch prices. Rates then come only from the vendored snapshot, which is always sufficient. |
+| `FEST_PRICING_URL` | internal mirror of litellm's price file. |
+| `FEST_GOOGLE_CLIENT_ID`, `FEST_GOOGLE_CLIENT_SECRET` | Google OAuth, for `fest login` and the dashboard. Absent means Google sign-in is off. |
+| `FEST_GITHUB_CLIENT_ID`, `FEST_GITHUB_CLIENT_SECRET` | GitHub OAuth, same idea. |
+| `FEST_ALLOWED_EMAIL_DOMAINS` | comma-separated. **Required to enable OAuth at all** — empty refuses every OAuth login rather than allowing any Google/GitHub account. |
+| `FEST_PUBLIC_URL` | base URL Fest is reachable at, for building the OAuth redirect URI. Defaults to `http://<host>:<port>`. |
+| `FEST_BASE_PATH` | mount path, if Fest is not at the root of its origin. Defaults to the path of `FEST_PUBLIC_URL`, so setting that is usually enough. |
+
+See [docs/CLI-AUTH.md](docs/CLI-AUTH.md) for the full OAuth setup and how
+`fest login`'s loopback flow works.
+
+### Behind Caddy, on a path
+
+Fest can be mounted under a path rather than on its own hostname —
+`https://lastlight.nearform.dev/fest`. Set `FEST_PUBLIC_URL` to the full URL
+including that path and Fest takes the mount point from it: the dashboard's
+`<base href>` is rewritten to match, and the OAuth redirect URI is built
+against it.
+
+```caddyfile
+lastlight.nearform.dev {
+	handle_path /fest/* {
+		reverse_proxy 127.0.0.1:8787 {
+			# SSE: /api/live is a long-lived event stream, and a buffering
+			# proxy turns the live screen into a screen that updates once.
+			flush_interval -1
+		}
+	}
+}
+```
+
+```bash
+FEST_PUBLIC_URL=https://lastlight.nearform.dev/fest
+FEST_SECURE_COOKIES=1
+```
+
+`handle_path` strips the `/fest` prefix before proxying. A plain `handle` +
+`reverse_proxy`, which does not strip it, works too — Fest removes its own
+mount path from an incoming request when it is still there, so either spelling
+routes. Caddy passes the original `Host` upstream by default, which the CSRF
+origin check needs; on nginx that is `proxy_set_header Host $host`, and
+`proxy_buffering off` for the event stream.
+
+The registered OAuth redirect URI must include the path —
+`https://lastlight.nearform.dev/fest/api/auth/oauth/google/callback`. Developers
+point both Claude Code and the CLI at the full prefixed URL
+(`fest login --server https://lastlight.nearform.dev/fest`).
+
+## Requirements
+
+Node >= 22.18 (TypeScript runs directly via native type stripping — no build
+step for the server). Vite + React are used only for the dashboard, later.
+
+## Commands
+
+```bash
+npm test          # node --test
+npm run canary    # version gate: re-run before rolling out a Claude Code release
+npm run capture   # Phase 0 capture server
+npm run typecheck # tsc --noEmit (needs npm install first)
+npm run dev       # gateway + dashboard with hot reload
+npm run demo      # synthetic traffic in a scratch database, then both of the above
+```
+
+```bash
+node server/bin/fest.ts admin create <email> [--role R] [--password-stdin]
+node server/bin/fest.ts admin list | admin passwd <email> | admin disable <email>
+node server/bin/fest.ts token create <email> [name] | token list | token revoke <id>
+```

package/dist/cli/claude.js

@@ -0,0 +1,326 @@
+/**
+ * `fest claude`: run the real `claude` binary, pointed at this developer's
+ * Fest gateway, in whichever of two postures will actually work here.
+ *
+ * **Subscription posture** sets `ANTHROPIC_BASE_URL` to the path-prefixed
+ * identity carrier (`server/auth/posture.ts`'s `parseIdentityPath`) and sets no
+ * credential, so Claude Code's own OAuth login pays. **Gateway posture** sets a
+ * bare base URL plus `ANTHROPIC_AUTH_TOKEN=<fest token>`, so the server's own
+ * credentials pay and the server-published `/model` menu becomes reachable.
+ *
+ * The two are mutually exclusive in the client: gateway model discovery needs a
+ * credential in the environment, and any such credential disables subscription
+ * auth. So Fest picks — OAuth login present → subscription, absent → gateway —
+ * and `fest claude gw` forces gateway when a developer wants the menu anyway.
+ *
+ * Both postures strip every demotion var first — the same reasoning
+ * `tools/canary.ts` applies to its test client, from the same
+ * `shared/demotion-vars.ts` list. Gateway posture then sets its token *after*
+ * that strip rather than exempting it, so an inherited `ANTHROPIC_API_KEY` can
+ * never survive alongside the Fest token.
+ */
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { DEMOTION_VARS } from "../shared/demotion-vars.js";
+import { BASE_MODELS } from "../shared/base-models.js";
+import { readCliConfig } from "./config.js";
+/**
+ * Pure, so it's testable without spawning a real `claude` binary.
+ *
+ * Defaults to subscription posture: that is what `fest claude` did before there
+ * was a choice, and it remains the answer for a developer with their own login.
+ */
+export function buildClaudeEnv(base, cfg, posture = "subscription") {
+    const env = { ...base };
+    for (const v of DEMOTION_VARS)
+        delete env[v];
+    if (posture === "key") {
+        env["ANTHROPIC_BASE_URL"] = cfg.serverUrl;
+        // Set after the strip, never by exempting it from the strip list.
+        env["ANTHROPIC_AUTH_TOKEN"] = cfg.identityToken;
+    }
+    else {
+        env["ANTHROPIC_BASE_URL"] = `${cfg.serverUrl}/t/${cfg.identityToken}`;
+    }
+    return env;
+}
+// ---------------------------------------------------------------------------
+// Detection — metadata and keys only, never a credential value
+// ---------------------------------------------------------------------------
+/** The four layers Claude Code merges settings from, most general first. */
+function settingsFiles() {
+    return [
+        join(homedir(), ".claude", "settings.json"),
+        join(homedir(), ".claude", "settings.local.json"),
+        join(process.cwd(), ".claude", "settings.json"),
+        join(process.cwd(), ".claude", "settings.local.json"),
+    ];
+}
+function readSettings(path) {
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return "unparseable";
+    }
+}
+/**
+ * Is this machine on an Anthropic OAuth subscription login?
+ *
+ * Read exactly as `tools/canary.ts::subscriptionLogin()` reads it — account
+ * metadata only. No credential lives in this function, and the reason string is
+ * printed to a developer's terminal, so nothing identifying goes in it either.
+ */
+export function detectSubscriptionLogin() {
+    const path = join(homedir(), ".claude.json");
+    if (!existsSync(path))
+        return { ok: false, detail: "no Anthropic subscription login found" };
+    const parsed = readSettings(path);
+    if (parsed === null || parsed === "unparseable") {
+        return { ok: false, detail: "~/.claude.json is unparseable" };
+    }
+    if (!parsed["oauthAccount"]) {
+        return { ok: false, detail: "no Anthropic subscription login found" };
+    }
+    return { ok: true, detail: "Anthropic OAuth login found" };
+}
+/**
+ * Settings-layer demotion triggers, by KEY only.
+ *
+ * `buildClaudeEnv` can strip a poisoned env var; it cannot touch these, because
+ * the client reads its own settings files. In subscription posture that is the
+ * silent failure this whole project exists to prevent: the developer believes
+ * they are on their own plan, and the session is quietly billed to someone
+ * else's key. Values are never read — `env.ANTHROPIC_API_KEY` in a settings
+ * file is a live secret.
+ */
+export function settingsDemotionTriggers() {
+    const found = [];
+    for (const path of settingsFiles()) {
+        const parsed = readSettings(path);
+        if (parsed === null)
+            continue;
+        if (parsed === "unparseable") {
+            found.push(`${path}: unparseable, cannot check it`);
+            continue;
+        }
+        if (parsed["apiKeyHelper"])
+            found.push(`${path}: apiKeyHelper`);
+        for (const v of DEMOTION_VARS) {
+            if (parsed["env"] && v in parsed["env"])
+                found.push(`${path}: env.${v}`);
+        }
+    }
+    return found;
+}
+/**
+ * The model the session will open on, as far as the CLI can observe it.
+ *
+ * Precedence follows the client's own: an explicit `--model` beats
+ * `ANTHROPIC_MODEL`, which beats a `model` key in the settings layers (most
+ * specific layer wins). `null` means *unknown* — Claude Code's built-in default
+ * or the developer's last selection, neither of which is visible from here.
+ */
+export function resolveIntendedModel(argv, env) {
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--model" && i + 1 < argv.length)
+            return argv[i + 1];
+        if (arg.startsWith("--model="))
+            return arg.slice("--model=".length);
+    }
+    const fromEnv = env["ANTHROPIC_MODEL"];
+    if (fromEnv !== undefined && fromEnv !== "")
+        return fromEnv;
+    let fromSettings = null;
+    for (const path of settingsFiles()) {
+        const parsed = readSettings(path);
+        if (parsed === null || parsed === "unparseable")
+            continue;
+        if (typeof parsed["model"] === "string" && parsed["model"] !== "")
+            fromSettings = parsed["model"];
+    }
+    return fromSettings;
+}
+/**
+ * Does the model this session will open on have a substitute route?
+ *
+ * "The menu is non-empty" is not the question. In gateway posture there is no
+ * caller credential to fall back on, so an unrouted model 401s on the first
+ * message — and against a typical routing table the menu is full while Opus and
+ * Haiku are both unrouted. This turns that first-message 401 into a sentence
+ * read before the session starts.
+ *
+ * Pure: the fetch lives in `fetchServableModels`, so the cliff logic is
+ * testable without a socket.
+ */
+export function checkServable(menu, intended) {
+    const servable = [...menu].sort();
+    const list = servable.join(", ");
+    if (intended !== null) {
+        if (servable.includes(intended))
+            return { kind: "ok", message: "" };
+        return {
+            kind: "fatal",
+            message: `${intended} has no substitute route on this gateway; in gateway posture it would fail on the first message.\n` +
+                `Servable: ${list}`,
+        };
+    }
+    // Unknown: the client will open on its own default or last selection. Name
+    // precisely which of Anthropic's base models would fail if it picks one.
+    const missing = BASE_MODELS.filter((m) => !servable.includes(m.id));
+    if (missing.length === 0)
+        return { kind: "ok", message: "" };
+    const names = missing.map((m) => m.name);
+    const subject = names.length === 1 ? `${names[0]} is` : `${names.slice(0, -1).join(", ")} and ${names.at(-1)} are`;
+    const object = names.length === 1 ? "it" : names.length === 2 ? "either" : "any of them";
+    return {
+        kind: "warn",
+        message: `${subject} not routed on this gateway; selecting ${object} will fail.\nServable: ${list}`,
+    };
+}
+/** How long to wait for the menu. The client's own discovery timeout is 3s. */
+const MENU_TIMEOUT_MS = 3_000;
+/**
+ * `GET /v1/models` — served without identity resolution, so no auth header is
+ * needed here.
+ *
+ * A 404 or an empty list is fatal: gateway posture with no substitute routes
+ * cannot serve anything. A network error is only a warning — a flaky link must
+ * not brick a known-good gateway.
+ */
+export async function fetchServableModels(serverUrl) {
+    let res;
+    try {
+        res = await fetch(`${serverUrl}/v1/models?limit=1000`, {
+            signal: AbortSignal.timeout(MENU_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        return {
+            ok: false,
+            fatal: false,
+            message: `could not reach ${serverUrl}/v1/models (${err instanceof Error ? err.message : String(err)}) — continuing unchecked.`,
+        };
+    }
+    if (res.status === 404) {
+        return {
+            ok: false,
+            fatal: true,
+            message: `${serverUrl} publishes no gateway models, so gateway posture has nothing to serve.\n` +
+                "The gateway needs substitute routes — check FEST_ROUTES on the server.",
+        };
+    }
+    if (!res.ok) {
+        return { ok: false, fatal: false, message: `GET /v1/models returned ${res.status} — continuing unchecked.` };
+    }
+    let body;
+    try {
+        body = (await res.json());
+    }
+    catch {
+        return { ok: false, fatal: false, message: "GET /v1/models returned unparseable JSON — continuing unchecked." };
+    }
+    const ids = (body.data ?? []).map((m) => m.id).filter((id) => typeof id === "string");
+    if (ids.length === 0) {
+        return {
+            ok: false,
+            fatal: true,
+            message: `${serverUrl} publishes an empty model menu, so gateway posture has nothing to serve.\n` +
+                "The gateway needs substitute routes — check FEST_ROUTES on the server.",
+        };
+    }
+    return { ok: true, ids };
+}
+// ---------------------------------------------------------------------------
+// Running it
+// ---------------------------------------------------------------------------
+const note = (s) => void process.stderr.write(`fest claude: ${s}\n`);
+/**
+ * Warnings about the *chosen* posture. Collected separately from the notice
+ * line because the posture is now something Fest asserts rather than something
+ * the developer typed — so every consequence of that assertion is said out loud.
+ */
+export function postureWarnings(posture, env, triggers) {
+    const warnings = [];
+    const discovery = env["CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY"];
+    if (posture === "subscription") {
+        for (const trigger of triggers) {
+            warnings.push(`${trigger} will demote this session off your subscription. Clear it or expect org billing.`);
+        }
+        if (discovery !== undefined && discovery !== "") {
+            warnings.push("Gateway model discovery is unavailable in subscription posture. Use `fest claude gw`.");
+        }
+        return warnings;
+    }
+    if (discovery === undefined || discovery === "") {
+        warnings.push("Export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 to see gateway models in /model.");
+    }
+    if (env["_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL"]) {
+        // An explicit override: warn, don't strip.
+        warnings.push("_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL disables gateway discovery. Unset it.");
+    }
+    return warnings;
+}
+export async function runClaude(argv, requested = "auto") {
+    const cfg = await readCliConfig();
+    if (cfg === null) {
+        throw new Error("not logged in. Run `fest login` first.");
+    }
+    const login = requested === "auto" ? detectSubscriptionLogin() : null;
+    const posture = requested === "auto" ? (login.ok ? "subscription" : "key") : requested;
+    // Who pays, every time — not only on `gw`. Auto-detection changes the answer
+    // for a developer with no subscription login, so it must never be implicit.
+    if (requested !== "auto") {
+        note("gateway posture forced — org credentials pay.");
+    }
+    else if (posture === "subscription") {
+        note(`subscription posture (${login.detail}) — your own plan pays.`);
+    }
+    else {
+        note(`gateway posture (${login.detail}) — org credentials pay.`);
+    }
+    for (const w of postureWarnings(posture, process.env, posture === "subscription" ? settingsDemotionTriggers() : [])) {
+        note(w);
+    }
+    if (posture === "key") {
+        const menu = await fetchServableModels(cfg.serverUrl);
+        if (!menu.ok) {
+            if (menu.fatal)
+                throw new Error(menu.message);
+            note(menu.message);
+        }
+        else {
+            const verdict = checkServable(menu.ids, resolveIntendedModel(argv, process.env));
+            if (verdict.kind === "fatal")
+                throw new Error(verdict.message);
+            if (verdict.kind === "warn")
+                note(verdict.message);
+        }
+    }
+    const env = buildClaudeEnv(process.env, cfg, posture);
+    const child = spawn("claude", argv, { stdio: "inherit", env });
+    const code = await new Promise((resolve, reject) => {
+        child.on("error", (err) => {
+            if (err.code === "ENOENT") {
+                reject(new Error("`claude` was not found on PATH. Install Claude Code first."));
+            }
+            else {
+                reject(err);
+            }
+        });
+        child.on("exit", (exitCode, signal) => {
+            if (signal !== null) {
+                process.kill(process.pid, signal);
+                return;
+            }
+            resolve(exitCode ?? 1);
+        });
+    });
+    process.exitCode = code;
+}
+//# sourceMappingURL=claude.js.map

package/dist/cli/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../cli/claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQ5C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAkD,EAClD,GAAiD,EACjD,UAAmB,cAAc;IAEjC,MAAM,GAAG,GAAuC,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,aAAa;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAE7C,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,oBAAoB,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;QAC1C,kEAAkE;QAClE,GAAG,CAAC,sBAAsB,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,oBAAoB,CAAC,GAAG,GAAG,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,4EAA4E;AAC5E,SAAS,aAAa;IACpB,OAAO;QACL,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,qBAAqB,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAuB,EACvB,GAAiD;IAEjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAClE,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC;IAE5D,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,aAAa;YAAE,SAAS;QAC1D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;YAAE,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAWD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuB,EAAE,QAAuB;IAC5E,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACpE,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EACL,GAAG,QAAQ,oGAAoG;gBAC/G,aAAa,IAAI,EAAE;SACtB,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE7D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GACX,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;IACzF,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,GAAG,OAAO,0CAA0C,MAAM,0BAA0B,IAAI,EAAE;KACpG,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,eAAe,GAAG,KAAK,CAAC;AAM9B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,uBAAuB,EAAE;YACrD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,mBAAmB,SAAS,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B;SAChI,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI;YACX,OAAO,EACL,GAAG,SAAS,0EAA0E;gBACtF,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,GAAG,CAAC,MAAM,0BAA0B,EAAE,CAAC;IAC/G,CAAC;IAED,IAAI,IAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IAClH,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC;IACpG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI;YACX,OAAO,EACL,GAAG,SAAS,4EAA4E;gBACxF,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,IAAI,GAAG,CAAC,CAAS,EAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAgB,EAChB,GAAiD,EACjD,QAA2B;IAE3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAEpE,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,kFAAkF,CAAC,CAAC;QAC9G,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,CAAC,0CAA0C,CAAC,EAAE,CAAC;QACpD,2CAA2C;QAC3C,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAuB,EAAE,YAA8B,MAAM;IAC3F,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,OAAO,GAAY,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjG,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,+CAA+C,CAAC,CAAC;IACxD,CAAC;SAAM,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC,yBAAyB,KAAM,CAAC,MAAM,yBAAyB,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,oBAAoB,KAAM,CAAC,MAAM,0BAA0B,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACpH,IAAI,CAAC,CAAC,CAAC,CAAC;IACV,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACjF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAgB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAE3E,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC"}